CVSS: 10.0EPSS: 40%CPEs: -EXPL: 2CVE-2024-51567 – CyberPanel Incorrect Default Permissions Vulnerability
https://notcve.org/view.php?id=CVE-2024-51567
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected. upgrademysqlstatus en databases/views.py en CyberPanel (también conocido como Cyber Panel) anterior a 5b08cd6 permite a atacantes remotos omitir la autenticación y ejecutar comandos arbitrarios a través de /dataBases/upgrademysqlstatus omitiendo secMiddleware (que es solo para una solicitud POST) y utilizando metacaracteres de shell en la propiedad statusfile, como lo explotó PSAUX en octubre de 2024. Las versiones hasta 2.3.6 y 2.3.7 (sin parchear) se ven afectadas. CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. • https://github.com/thehash007/CVE-2024-51567-RCE-EXPLOIT https://github.com/ajayalf/CVE-2024-51567 https://cwe.mitre.org/data/definitions/420.html https://cwe.mitre.org/data/definitions/78.html https://cyberpanel.net/KnowledgeBase/home/change-logs https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce https://github.com/usmannasir/cyberpanel/commi • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-44236 – Apple macOS ICC Profile Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-44236
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. • https://support.apple.com/en-us/121568 https://support.apple.com/en-us/121570 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-44284 – Apple macOS ICC Profile Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-44284
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. • https://support.apple.com/en-us/121568 https://support.apple.com/en-us/121570 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: -EXPL: 0CVE-2024-44215 – Apple macOS ImageIO JP2 Image Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-44215
An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. • https://support.apple.com/en-us/121563 https://support.apple.com/en-us/121565 https://support.apple.com/en-us/121566 https://support.apple.com/en-us/121567 https://support.apple.com/en-us/121568 https://support.apple.com/en-us/121569 https://support.apple.com/en-us/121570 •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-44218 – Apple SceneKit Improper Validation of Array Index Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-44218
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. • https://support.apple.com/en-us/121563 https://support.apple.com/en-us/121567 https://support.apple.com/en-us/121570 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •